Privacy policy

Privacy Policy of the website www.shopiemonte.com

Processing of personal data

Data Controller

Website

SHOPIEMONTE SRL is the holder and owner of the contents of the site www.shopiemonte.com from now on "Site". The Site is hosted on hosting managed by Hypernode - https://www.hypernode.com/en/ - whose servers are located in Belgium (EU).

What personal data is collected and why (type of data, purpose and legal basis)

By browsing this Site, personal data may be collected, as better specified below. Cookies are also installed, as you can read in the cookie policy.

• Navigation Data

The site's computer systems implicitly collect, during their operation, some personal data (provided for by Internet communication protocols). These are not associated with specific subjects, except through a complex and complicated system of processing and association with other data held by third parties. This category of personal data includes the IP addresses or domain names of the computers used by users who connect to the site, the browsers and parameters of the computer system used to connect to the site, navigation data, including time of request and response obtained from the server. 
Data processed: IP addresses or domain names of the computers used by users who connect to the site, browsers and parameters of the computer system used to connect to the site, navigation data, including time of the request and response obtained from the server.
Purpose: use of the site, any anonymous statistics on the use of the Site.
Legal basis: legitimate interest of the Data Controller.
Data transfer outside the EU: no.

• Contact form

In case of completing the contact form on the Site, the User is required to provide his/her name and email address, which are necessary for the Owner to follow up on the request received.
Data processed: name, email address, User message.
Purpose: response to a request received from the User.
Legal basis: consent, expressed at the bottom of the form.
Data transfer outside the EU: no.

• Newsletter and promotional offers 

To subscribe to the newsletter, it is necessary to provide your name and e-mail address, which the User enters into the form. The provision of this data is voluntary, but necessary to be able to send the newsletter. The personal data provided are processed for the sole purpose of sending the newsletter to which the User has asked to subscribe, through the Site. The processing of data relating to the sending of the newsletter takes place through and on the servers used by Klavijo, whose servers are located outside the EU and which holds the role of data controller pursuant to art. 28 GDPR. You can read the Data processing agreement here https://www.klaviyo.com/legal/data-processing-agreement, i.e. the agreement between the Data Controller and the data controller for data management. 
Data processed: name, email address. 
Purpose: sending the newsletter and promotional offers.
Legal basis: consent provided by the user. 
Data transfer outside the EU: yes.

• Purchase of products

On the Site there is a section dedicated to the sale of food products. To purchase, you need to access the area dedicated to the shop and create your own account, with username and password. After inserting the desired products into the shop cart, it is necessary to fill in the form to collect the data necessary for purchase and shipping: name, surname, date of birth (optional, for promotional purposes), shipping address, shipping address billing, email address, telephone.
Payment for the products purchased (with the conclusion of the transaction) takes place through credit card, in an area outside the site, without the payment instrument data being shared with Shopiemonte. 
This is Multisafepay's privacy policy: https://www.multisafepay.com/it_it/formazione-sulla-privacy 
The data relating to purchases are also necessary to proceed with the invoicing and management of purchases. 
Data processed: name, surname, date of birth (optional, for promotional purposes), shipping address, billing address, email address, telephone number. 
Purpose: purchase, shipping and invoicing 
Legal basis: fulfillment of a contract, consent provided by the user and compliance with tax/legal regulations. 
Data transfer outside the EU: no.

• Product comments

When you write a comment on a product, you must access your reserved area with user and password. 
Data processed: user and password, comment written by the user. 
Purpose: comment on the products. 
Legal basis: User consent.

• Data acquired through Facebook / Instagram / Youtube advertisements 

The site acquires some personal data of Facebook / Instagram / Youtube users, who respond to sponsored advertisements on these social channels. The data acquired through these channels are processed in compliance with the indications provided by the policies of each social network, in particular such data will never be transferred to data intermediaries or sold to third parties (except for the necessary transfers to a service provider). 
Here is the Facebook policy: https://www.facebook.com/about/privacy/. 
Here is Instagram's policy: https://help.instagram.com/519522125107875. 
Here is the Youtube policy: https://www.youtube.com/intl/ALL_it/howyoutubeworks/our-commitments/protecting-user-data/. 
In any case, the Site uses user data in any advertisement only after obtaining the necessary consent. Users can opt out of the collection and use of information for ad targeting. For more information you can visit http://www.aboutads.info/choices and http://www.youronlinechoices.eu/. 
Data processed: various navigation data and data collected by ADV service providers. 
Purpose: targeting of users. 
Legal basis: consent/legitimate interest. 
Data transfer outside the EU: yes.

• Data acquired through Smartbox / Welfare WAI advertisements 

The site acquires some personal data of Smartbox / WAI users, who respond to sponsored advertisements on these social channels. The data acquired through these channels are processed in compliance with the indications provided by the policies of each social network, in particular such data will never be transferred to data intermediaries or sold to third parties (except for the necessary transfers to a service provider). 
Here is the Smartbox policy: https://www.smartbox.com/it/protezione-dei-dati-personali/ 
Here is the WAI policy: https://www.welfareimpresaleitalia.com/wp-content/uploads/2022/02/Privacy-Policy-Sito-WAI.pdf 
In any case, the Site uses user data in any advertisement only after obtaining the necessary consent. Users can opt out of the collection and use of information for ad targeting. For more information you can visit http://www.aboutads.info/choices and http://www.youronlinechoices.eu/. 
Data processed: various navigation data and data collected by ADV service providers. 
Purpose: targeting of users. 
Legal basis: consent/legitimate interest. 
Data transfer outside the EU: yes.

• Google Fonts

The Google Fonts tool is used to display styles and fonts within the site - https://policies.google.com/privacy?hl=it 
Data processed: site usage data. 
Purpose: display styles and fonts. 
Legal basis: legitimate interest of the Data Controller. 
Data transfer outside the EU: yes.

• Tag management 

The tag management tool is used to monitor the activity of users of a site (anonymously) in order to make decisions for the management of the site itself. This site uses Google Tag Manager - https://policies.google.com/privacy?hl=it 
Data processed: site usage data. 
Purpose: tag management. 
Legal basis: legitimate interest of the Data Controller. 
Data transfer outside the EU: yes.

• Google ADS remarketing

It is a tool for targeting users, who can thus receive targeted advertising, based on the profile set. Here is the relevant policy: https://policies.google.com/technologies/cookies?hl=it 
Data processed: site usage data, information set by the User. 
Purpose: User targeting/marketing. 
Legal basis: consent/legitimate interest. 
Data transfer outside the EU: yes.

• Google ADS conversion tracking 

Statistics service that connects data from advertisements with actions performed on the Site. 
Here is the relevant policy: https://policies.google.com/technologies/cookies?hl=it 
Data processed: site usage data. 
Purpose: analysis of traffic data in aggregate and anonymous form. 
Legal basis: legitimate interest of the Data Controller.

• Facebook Pixel 

Pixel is a tool for tracking the behavior of users of a site, which allows the collection of aggregate and anonymous data on navigation, to insert users into groups consistent with the interests expressed (user targeting). When users access a social network, they will then be shown advertisements consistent with their interests, based on the relevant policies of the social network. 
Here is the Facebook policy: https://www.facebook.com/about/privacy/. 
Data processed: online identifiers, including cookie identifiers and IP addresses, data relating to navigation on the Site.
Purpose: user targeting, advertising.
Legal basis: consent/legitimate interest.
Data transfer outside the EU: yes.

• Google Maps widget

Through the dedicated widget, it is possible to integrate Goolge Maps into the site. Here is the relevant policy. 
Data processed: cookies and site usage data. 
Purpose: use of the Google Maps tool. 
Legal basis: legitimate interest of the Data Controller. 
Data transfer outside the EU: yes.

• Font Awesome 

The tool provided by fontawesome.com allows you to integrate various types of icons into the site. Here is the relevant policy: https://fontawesome.com/privacy 
Data processed: site usage data. 
Purpose: use of icons. 
Legal basis: legitimate interest of the Data Controller. 
Data transfer outside the EU: yes.

Treatment and conservation methods

The data processing is carried out in an automated manner, in compliance with the provisions of the art. 32 of the GDPR 2016/679 regarding security measures; that is, the data are processed and managed in such a way as to avoid or in any case limit as much as possible the risks of loss, destruction, theft and in such a way as to allow their restoration, if one of the cases described were to occur. Based on the provisions of the art. 4 of the GDPR 2016/679, the data provided may be: collected, recorded, organised, stored, consulted, processed, modified, selected, extracted, compared, used, interconnected, blocked, communicated, deleted and destroyed. Suitable data protection systems have been adopted.

Data retention period 

The data is stored for the technical times necessary for the indicated uses. In any case, the User has the right to request the destruction or deletion of the data provided. The data may also be stored for a longer period, to fulfill fiscal obligations or the order of an Authority. At the end of the period necessary for conservation, the data will be deleted and no longer recoverable.

Communication and dissemination of data

Personal data will never be disclosed and will not be communicated without the User's explicit consent.

Data access

The data could be made accessible due to a legal obligation, which may involve the transfer of data to public bodies, judicial authorities, insurance bodies. The data may be visible to an IT consultant/technician who must operate for the repair/maintenance of the IT systems and the website, to the agency in charge of marketing and advertising activities, as well as to authorized Shop Piemonte employees for carrying out the relevant tasks . For any information you can write by email to [email protected].

Transfer of personal data 

The data may be transferred to third countries not belonging to the European Union, based on what is better specified above, with reference to each function.

Special categories of personal data 

The Site does not collect or process data that can be classified as "special categories of personal data", pursuant to articles 9 and 10 of the GDPR 2016/679.

Rights of the interested party

At any time, the user may exercise, pursuant to articles 15 to 22 of the GDPR 2016/679, the right to: 

• a) request confirmation of the existence or otherwise of personal data concerning him; 
• b) obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the retention period; 
• c) obtain the rectification and deletion of data; 
• d) obtain the limitation of processing; 
• e) obtain data portability, i.e. receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments; 
• f) object to processing at any time and also in the case of processing for direct marketing purposes; 
• g) oppose an automated decision-making process relating to natural persons, including profiling; 
• h) ask the data controller to access personal data and to rectify or cancel them or limit the processing that concerns them or to oppose their processing, in addition to the right to data portability; 
• i) revoke consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation; 
• j) lodge a complaint with a Supervisory Authority.

Methods of exercising rights